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Claim Objections 

Claim 32 is objected to because of the following informalities: Claim 32 depends 
on itself. The examiner has assumed for claim 32 to be dependent on claim 6. 
Appropriate correction is required. 

Drawings 

The drawings are objected to under 37 CFR 1 .83(a) because they fail to show 
trusted node (T) for item 5 in Figure 1 and Figure 2 as described in the specification. 
The drawing show trusted network element (T) for item 5 and the specification discloses 
trusted node (T). 

Any structural detail that is essential for a proper understanding of the disclosed 
invention should be shown in the drawing. MPEP § 608.02(d). Corrected drawing 
sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to 
avoid abandonment of the application. Any amended replacement drawing sheet should 
include all of the figures appearing on the immediate prior version of the sheet, even if 
only one figure is being amended. The figure or figure number of an amended drawing 
should not be labeled as "amended." If a drawing figure is to be canceled, the 
appropriate figure must be removed from the replacement sheet, and where necessary, 
the remaining figures must be renumbered and appropriate changes made to the brief 
description of the several views of the drawings for consistency. Additional replacement 
sheets may be necessary to show the renumbering of the remaining figures. Each 
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drawing sheet submitted after the filing date of an application must be labeled in the top 
margin as either "Replacement Sheet" or "New Sheet" pursuant to 37 CFR 1.121(d). If 
the changes are not accepted by the examiner, the applicant will be notified and 
informed of any required corrective action in the next Office action. The objection to the 
drawings will not be held in abeyance. 

Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter which the applicant regards as his invention. 

Claims 1 and 6 are rejected under 35 U.S.C. 112, second paragraph, as being 

indefinite for failing to particularly point out and distinctly claim the subject matter which 

applicant regards as the invention. It is unclear to the meaning of "trusted gateway (T)". 

The examiner interprets this to represent the "Trusted Network Element (T)" as defined 

in the disclosure per sections [0039-0041]. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 
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Claim 1-22, 24-25, 28, 30, 33 and 35 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Giniger et al. (US 6,751 ,729). 

As per claim 1, Giniger et al. discloses a method for performing mutual 
authentication and authorization of a user's terminal device (U) and an Internet Service 
Provider (P) (Col 1 1 lines 55-58) in order to establish secure communication between 
the terminal (U) and a trusted gateway (T) to the Internet via an untrusted access 
station (A) comprising: 

establishing an association between a terminal (U) and an untrusted access 
station (A); (Col 9 lines 30-35) 

transmitting an ISP authentication packet from terminal (U) to ISP (P) via the 
untrusted access station (A); (Col 14 lines 47-50) 

sending a user authentication packet Jrom said ISP (P) to said terminal (U) via 
said untrusted access station (A); (Col 8 lines 36-41) 

upon authentication of said terminal (U) and said ISP (P), said ISP performs the 
following: generating a session key; (Col 15 line 19) 

distributing said session key to said terminal (U) and a trusted gateway (T), 
wherein said session key is used to encrypt traffic between the terminal (U) and the 
trusted gateway (T); (Col 15 lines 19-22) 

establishing a secure tunnel such that the terminal (U) may communicate with 
the Internet via said trusted gateway (T); wherein said secure tunnel emulates a 
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physical link between the terminal (U) and the trusted gateway (T) (Col 1 1 lines 55-58) 
such that traffic transmitted between the terminal (U) and said Internet via said trusted 
gateway (T) is secure from modification or eavesdropping by said third party access 
station (A). (Col 12 lines 14-22, Col 6 lines 14-22) 

As per claim 2, Giniger et al. discloses the method for performing mutual 
authentication and authorization of a terminal (U) and an Internet Service Provider (P) in 
order to establish a secure tunnel between the terminal (U) and a trusted gateway to the 
Internet (T) via an untrusted access station (A) of claim 1, wherein the ISP (P) 
authentication packet contains an authentication challenge (CH_U) from terminal (U) to 
ISP (P) to authenticate the identity of ISP (P). (Col 5 lines 62-65, Col 12 lines 15-17, Col 
1 2 lines 25-27, Col 1 4 lines 57-62) 

As per claim 3, Giniger et al. discloses the method for performing mutual 
authentication and authorization of a terminal (U) and an Internet Service Provider (P) in 
order to establish a secure tunnel between the terminal (U) and a trusted gateway to the 
Internet (T) via an untrusted access station (A) of claim 1 , wherein the user 
authentication packet contains an authentication challenge (CH_P) from ISP (P) to the 
terminal (U) to authenticate the identity of user (U). (Col 5 lines 58-67, Col 12 lines 25- 
27, Col 14 lines 52-57) 
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As per claim 4, Giniger et al. discloses a method for providing public access to 
IP-based networks via an untrusted infrastructure having untrusted access points 
comprising: 

establishing a connection between an IP-device (U) and said untrusted access 
point (A), (Col 9 lines 30-35, Figure 2 item 220) wherein an IP address is dynamically 
allocated to said IP device; (Col 11 lines 59-63) 

transmitting an ISP authentication request from said IP device (U) to an internet 
service provider (P) affiliated with said IP device (U), (Col 14 lines 47-50) wherein said 
authentication request is transmitted through said untrusted access point (A) affiliated 
with said untrusted third party owned infrastructure; (Col 9 lines 30-35, Figure 2 item 
200) 

transmitting a user authentication request from said ISP (P) to said IP device (U) 
to determine whether said IP device (U) is a valid user affiliated with said ISP (P), (Col 8 
lines 36-41) wherein said authentication request is transmitted through said untrusted 
access point (A) affiliated with said untrusted third party owned infrastructure; (Col 9 
lines 30-35, Figure 2 item 200) 

when said ISP (P) authentication request and said user authentication requests 
is affirmative, (Col 14 lines 54-67) said ISP (P): generates a key session for encrypting 
data packets; and distributes said session key to said IP device (U) and a trusted node 
(T), wherein said session key is used to encrypt data transmitted between said IP 
device (U) and said trusted node (T); (Col 15 lines 19-22) 
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establishing a secure tunnel (Col 1 1 lines 55-58) as said session key is used to 
encrypt data packets transmitted between said IP device (U) and said trusted node (T), 
such that said data packets transmitted between said IP device (U) and an Internet via 
the untrusted access station (A) are protected from modification and manipulation by 
said untrusted access station (A) in said secure tunnel. (Col 12 lines 14-22, Col 6 lines 
14-22) 

As per claims 5, 6 and 35, Giniger et al. discloses a method for providing public 
access to IP-based networks through a third party owned, untrusted infrastructure 
having untrusted access stations (A) comprising: 

establishing a connection between an IP-device (U) and said access station (A), 
(Col 9 lines 30-35) wherein an IP address is dynamically allocated to said IP device (U); 
(Col 1 1 lines 59-63) sending an ISP authentication request to said internet service 
provider (P) affiliated with said IP device (U) requesting to validate the authenticity of 
the ISP (P); (Col 14 lines 47-50, Col 14 lines 57-62) 

sending a user authentication request from said ISP (P) to said IP device (U) to 
validate whether said IP device (U) has a service agreement with said ISP (P); (Col 14 
lines 47-54) upon affirmative authentication of said ISP (P) and said IP device (U); (Col 
14 lines 54-57) 

establishing a trusted connection between said IP device (U) and a trusted 
gateway (T), (Col 1 1 lines 55-58) wherein a secure tunnel allows the ISP (P) to 
dynamically obtain control of resource in (Col 16 lines 41-46) said untrusted third party 
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owned access station (A) (Col 9 lines 30-35, Figure 2 item 200) in order to provide the 
IP device (U) with prescribed for services. (Col 10 lines 9-20) 

As per claim 7, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
the ISP authentication request contains an authentication challenge (CH_U) from 
terminal (U) to ISP (P) to authenticate the identity of ISP (P). (Col 5 lines .62-65, Col 12 
lines 15-17, Col 12 lines 25-27, Col 14 lines 57-62) 

As per claim 8, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
the user authentication request contains an authentication challenge (CHJP) from ISP 
(P) to the terminal (U) to authenticate the identity of terminal (U) as having subscribed to 
said ISP (P) for services. (Col 5 lines 58-67, Col 12 lines 25-27, Col 14 lines 52-57) 

As per claim 9, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, the ISP 
(P) generates a session key for encrypting data packets upon the affirmative 
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authentication of the terminal (U) and the ISP (P). (Col 14 lines 54-67, Col 15 line 19- 
22) 

As per claim 10, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
the ISP (P) selects a trusted node (T) with said Internet. (Col 16 lines 42-45, Col 17 
lines 24-28) 

As per claim 1 1 , Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 9, wherein 
said ISP (P) distributes said session key to the terminal (U) and the trusted node (T). 
(Col 15 lines 19-22) 

As per claim 12, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
the session key is used to encrypt data packets transmitted between the terminal (U) 
and the trusted node (T). (Col 15 lines 19-22) 
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As per claim 13, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 12, wherein 
the transmission of encrypted data packets between the terminal (U) and the trusted 
node (T) established a secure tunnel. (Col 1 1 lines 55-58) 

As per claim 14, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 13, wherein 
the secure tunnel protects the data packets from manipulation by said untrusted access 
station (A). (Col 12 lines 14-22, Col 6 lines 14-22) 

As per claim 15, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, a time out 
is distributed to the trusted node (T) and terminal (U) upon the establishment of a 
secure tunnel. (Col 6 lines 23-27, Col 17 lines 28-34) 

As per claim 16, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 15, wherein 
the timeout value is set to a predetermined time period, wherein if the secure tunnel is 
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active for a time period equal to the timeout value, the secure tunnel will expire and the 
resources utilized for the secure tunnel will be releases. (Col 6 lines 23-27, Col 17 lines 
28-34) 

As per claim 17, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
upon receipt of an encrypted data packet from the terminal (U), the trusted node (T) 
decrypts the data packet and forwards the decrypted data packet to the Internet. (Col 7 
lines 45-48, Col 12 lines 19-22, Col 15 lines 19-22, Col 17 lines 44-47) 



As per claim 18, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 17, wherein 
upon receipt of an encrypted data packet from the terminal (U), the trusted node (T) 
decrypts the data packet and forwards the decrypted data packet to a remote 
communication peer (R). (Col 12 lines 19-22, Col 15 lines 19-22, Col 17 lines 44-47) 

As per claim 19, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 18, wherein 
the Internet sends an original data packet to the terminal (U) via the trusted node (T), 
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wherein the trusted node (T) encrypts the original data packet and forwards the 
encrypted data packet to the terminal (U) via the untrusted access station (A). (Col 9 
lines 30-35, Col 12 lines 19-22, Col 15 lines 19-22, Col 17 lines 44-47) 

As per claim 20, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 17, wherein 
upon receipt of the encrypted data packet from the trusted node (T), the terminal (U) 
utilizes the session key to decrypt the data packet thus yielding the original data packet 
from the Internet. (Col 13 lines 54-59, Col 15 lines 44-47, Col 17 lines 44-47) 

As per claim 21, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 18, wherein 
a remote communication peer (R) sends an original data packet to the terminal (U) via 
the trusted node (T), wherein the trusted node (T) encrypts the original data packet and 
forwards the encrypted data packet to the terminal (U) via the untrusted access station 
(A). (Col 9 lines 30-35, Col 12 lines 9-12, Col 15 lines 9-12, Col 17 lines 44-47) 



As per claim 22, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 21, wherein 
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upon receipt of the encrypted data packet from the trusted node (T), the terminal (U) 
utilizes the session key to decrypt the data packet thus yielding the original data packet 
from the remote communication peer (R). (Col 13 lines 54-59, Col 15 lines 44-47, Col 
17 lines 44-47) 

As per claim 24, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
the untrusted access station (A) is incorporated into a third party owned network 
infrastructure. (Col 9 lines 30-32) 

As per claim 25, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 24, wherein 
the ISP (P) provides the terminal (U) with at least one subscribed for service via an 
untrusted access station (A). (Col 10 lines 9-20) 

As per claim 28, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 24, wherein 
the untrusted access station (A) is located in the network infrastructure of a public 
facility. (Col 6 lines 14-16, Col 10 lines 9-20) 
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As per claim 30, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 24, wherein 
the untrusted access station (A) is located within the infrastructure of a private 
household or within the private infrastructure of a corporation or government institution. 
(Col 6 lines 44-46, Col 10 lines 9-20) 

As per claim 33, Giniger et al. discloses a method of establishing secure 
communication between a terminal (U), the Internet Service Provider (P) affiliated with 
that terminal and the Internet over an untrusted access station (A) of claim 6, wherein 
the terminal (U) recognizes a compatible access point by broadcasting a dynamic host 
configuration protocol (DHCP) request and receiving a "magic" DHCP response from 
the untrusted access station (A). (Col 9 lines 5-11, Col 11 lines 36-51, Col 11 lines 59- 
67, Col 12 lines 1-2) 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 
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Claims 23, 26-27, 29, 31-32 and 34 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Giniger et al. (US 6,751 ,729) in view of Rueda et al. 
(US2002/01 12076). 

As per claim 23, Giniger et al. discloses a method of claim 6, however, fails to 
disclose providing an accounting of time to the untrusted access station (A) for 
resources utilized by the terminal (U). Rueda et al. discloses wherein the ISP (P) 
provides an accounting of time to the untrusted access station (A) for resources utilized 
by the terminal (U). ([0202]) It would have been obvious to a person of ordinary skill in 
the art at the time the invention to provide an accounting of time to the untrusted access 
station (A) for resources utilized by the terminal (U) in the disclosure of Giniger et al. 
because it allows for proprietors of the system to bill for usage. ([0188]) 

As per claim 26, Giniger et al. discloses a method of claim 6, however, fails to 
disclose that the ISP (P) reimburses the untrusted access station (A) for resources 
expended on the terminal (U) according to an accounting of time. Rueda et al. 
discloses wherein the ISP (P) reimburses the untrusted access station (A) for resources 
expended on the terminal (U) according to an accounting of time. ([0189], [0202]). It 
would have been obvious to a person of ordinary skill in the art at the time the invention 
for the ISP (P) to reimburse the untrusted access station (A) for resources expended on 
the terminal (U) according to an accounting of time in the disclosure of Giniger et al. 
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because it is an excellent opportunity for advertisement and provide branding, services, 
and advertising messages to users. ([0189]) 

As per claim 27, Giniger et al. discloses a method of claim 25, however, fails to 
disclose the ISP (P) bills the terminal (U) for services provided to the terminal (U). 
Rueda et al. discloses wherein the ISP (P) bills the terminal (U) for services provided to 
the terminal (U). ([0188]) It would have been obvious to a person of ordinary skill in the 
art at the time the invention for the ISP (P) to bill the terminal (U) for services provided 
to the terminal (U) in the disclosure of Giniger et al. because it allows to charge costs 
incurred by the visiting client for system services. ([0200]) 

As per claim 29, Giniger et al. discloses a method of claim 28, however, fails to 
disclose the public facility is at least one of an airport, a convention center, a restaurant, 
a hotel, a library, and a school. Rueda et al. discloses wherein the public facility is at 
least one of an airport, a convention center, a restaurant, a hotel, a library, and a 
school. ([0063], [01 53]) It would have been obvious to a person of ordinary skill in the 
art at the time the invention for a public facility to be an airport, a convention center, a 
restaurant, a hotel, a library, and a school in the disclosure of Giniger et al. because it 
allows travelers would be able to have high-speed Internet access from within their 
suites with their computers that have been configured for their individual corporate 
LANs or home use. ([0063]). 
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As per claim 31 , Giniger et al. discloses a method of claim 6, however, fails to 
disclose the untrusted access stations (A) is compatible with at least one wireless 
transmission. Rueda et al. discloses wherein the untrusted access stations (A) is 
compatible with at least one wireless transmission standard including WLAN (IEEE 
802.11), BlueTooth (IEEE 802.15), or HiperLan. ([0267], [0268]) It would have been 
obvious to a person of ordinary skill in the art at the time the invention for the untrusted 
access stations (A) to be compatible with at least one wireless transmission because it 
provides laptop access using wireless Ian cards. ([0268]) 

As per claim 32, Giniger et al. discloses a method of claim 6, however fails to 
disclosure the terminal (U) is a mobile device. Rueda et al. discloses wherein the 
terminal (U) is a mobile device. ([0063], [0207], [0274]) It would have been obvious to 
a person of ordinary skill in the art at the time the invention for the terminal (U) to be a 
mobile device in the invention of Giniger et al. because more and more business 
transactions are initiated, negotiated and closed with no concern for geography. 
([0063]) 

As per claim 34, Giniger et al. discloses a method of claim 6, however, fails to 
disclose the assigning a local unique identification (LUID) to the terminal (U) in order to 
facilitate matching the terminal with data packets. Rueda et al. discloses wherein the 
untrusted access station (A) assigns an local unique identification (LUID) to the terminal 
(U) in order to facilitate matching the terminal with data packets when the untrusted 
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access station (A) is simultaneously serving multiple terminals (U). ([0135]-[0136], 
Figure 14). It would have been obvious to a person of ordinary skill in the art at the time 
the invention to assign a local unique identification (LUID) to the terminal (U) in the 
disclosure of Giniger et al. because it allows a server system to send a packet back to 
the correct client when two or more clients have the same IP address. ([0134]) 



Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. Redlich (US 6,591,306) discloses an access routing method for 
an access router of a hosting network to provide IP service to a guest station. Bots et 
al. (US 6,226,748) discloses protocols and architecture for implementing secure private 
networks. Gilbrech (US 6,173,399) discloses an apparatus for providing secure data 
communications between members of a virtual private network. Liu (US 6,079,020) 
discloses an apparatus for managing a virtual private network over a public data 
network. Kakemizu et al. (US2002/00 18456) discloses providing a VPN setting service 
that enables the communications in the mobile IP to be carried out by using a safe 
communication path. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Chirag R. Patel whose telephone number is 
(571)272-7966. The examiner can normally be reached on Monday to Friday from 
7:30AM to 4:00PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia, can be reached on (571) 272-3880. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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